PUA - Ngrok Execution
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available. Involved domains are bin.equinox.io for download and *.ngrok.io for connections.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND COMMANDLINE contains " tcp 139, tcp 445, tcp 3389, tcp 5985, tcp 5986" OR (COMMANDLINE contains " start " AND COMMANDLINE contains "--all" AND COMMANDLINE contains "--config" AND COMMANDLINE contains ".yml") OR (PROCESSNAME endswith "ngrok.exe" AND COMMANDLINE contains " tcp , http , authtoken ") OR COMMANDLINE contains ".exe authtoken ,.exe start --all" select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Florian Roth (Nextron Systems)
